topic Re: IPSec VPN (non site to site) in General Topics

IPSec VPN (non site to site)

AMPAN2011 — Wed, 08 Feb 2012 19:35:55 GMT

Is there any document that shows how to configure IPSec VPN (or any vpn rather than SSL) on the PAN? I am not looking for site to site. I only found site to site configuration. The solution will be for clients who can vpn in remotely from everywhere. I'd like to offer this as a second vpn solution after ssl vpn which sometimes give a few issues to remote users. Thanks very much

Re: IPSec VPN (non site to site)

mikand — Thu, 09 Feb 2012 08:18:18 GMT

There are some docs in the devcenter if im not mistaken, otherwise this should be already described in the administrator manual which you find if you click on Technical Documentation at https://support.paloaltonetworks.com

Re: IPSec VPN (non site to site)

AMPAN2011 — Thu, 09 Feb 2012 17:12:14 GMT

Thanks. In fact I did looked at the admin guide yesterday from page 161-170. I got IPSec config done on PA2050 with some tweakings because the admin guide instruction is too general. I will try the IPSec vpn client, TheGreenBow, which works on the Netscreen to see how it goes. I am new to PAN and just realized that ssl vpn has so many issues with windows 7 and mac

Re: IPSec VPN (non site to site)

mikand — Thu, 09 Feb 2012 17:17:08 GMT

Dont forget the proxy-id (which seems to be the no1 mistake when ipsec stuff wont work :smileysilly:)

Re: IPSec VPN (non site to site)

AMPAN2011 — Thu, 09 Feb 2012 17:22:31 GMT

Thanks for the tip. I don't think it will work on first try so I will have to go back and do more tweakings

Re: IPSec VPN (non site to site)

sdurga — Thu, 09 Feb 2012 18:04:35 GMT

Hi,

I dont think PAN devices support certificate based IPsec Vpns, as SSL-Vpns(global protect ) is providing this functionality. So, in this case after SSL-VPN as your first option, i am not sure what will be your backup Vpn option.

Tx,

Sandeeep.

Re: IPSec VPN (non site to site)

AMPAN2011 — Thu, 09 Feb 2012 18:37:53 GMT

This is the error I get now on the PAN. Going back to the config to look

IKE phase-2 negotiation failed when processing proxy ID. cannot find matching phase-2 tunnel for received proxy ID. received local id: 172.16.0.0/16 type IPv4_subnet protocol 0 port 0, received remote id: 10.1.10.73/32 type IPv4_address protocol 0 port 0.

Re: IPSec VPN (non site to site)

AMPAN2011 — Thu, 09 Feb 2012 19:11:20 GMT

Looks like I'll need to contact support for this. Hopefully I can get a solution from them

Re: IPSec VPN (non site to site)

AMPAN2011 — Fri, 10 Feb 2012 17:32:14 GMT

It finally worked as of yesterday after talking to support and quite a few tweakings on the PAN and on my GreenBow IPSec vpn client. I will test simutaneously vpn connections to see how it works

Re: IPSec VPN (non site to site)

AMPAN2011 — Fri, 10 Feb 2012 17:33:50 GMT

In this case, I don't need certificate. A simple IPSec is sufficient. It's working for me now. Thx

Re: IPSec VPN (non site to site)

AMPAN2011 — Thu, 23 Feb 2012 00:30:39 GMT

I can now have multiple IPSec clients connect at the same time.